4

I want to know if strangers have accessed the database.

If so, I want to find out how they got access to the database.

I found a strange trigger in the database (screenshot below).

enter image description here

3

Your site contains a skimmer disguised as googletagmanager.eu. Attackers managed to inject this skimmer in over 270 stores this week, and - sadly - also yours.

In the cases that I investigated, attackers used a flaw in MySQL/adminer to gain access to the victim sites. Because you shared an adminer screenshot, I suspect they used the same method on your store.

You should thoroughly scrutinize your site for hidden backdoors, disguised admin accounts and such. My eCommmerce anti-virus may help. See also:

https://gwillem.gitlab.io/2019/01/17/adminer-4.6.2-file-disclosure-vulnerability/

https://twitter.com/gwillem/status/1098926474571235329

  • Thanks for writing. I would like to take your offer to help. – Jam Feb 22 at 23:20
  • Email me at gwillem@gmail.com – Willem Feb 23 at 1:29
1

@Jam: Your site is definitely infected. You can see the more details on below URL from Willem.

https://gwillem.gitlab.io/2017/02/14/triggered-malware/

You can see more details on the the exact issue you have on his website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.